| Summary: | No filtering on suggestion at the OPAC | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Jonathan Druart <jonathan.druart> |
| Component: | Architecture, internals, and plumbing | Assignee: | Jonathan Druart <jonathan.druart> |
| Status: | CLOSED FIXED | QA Contact: | Julian Maurice <julian.maurice> |
| Severity: | critical | ||
| Priority: | P5 - low | CC: | 1joynelson, bastien.gonckel, corinne.hayet, f.demians, fridolin.somers, jonathan.druart, julian.maurice, kyle, laurent.ducos, lucas, m.de.rooy, magnus, martin.renvoize, mengu, nick, nicolas.legrand, sonia.bouis, victor, ztajoli |
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | All | ||
| See Also: |
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28929 https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28935 |
||
| Change sponsored?: | --- | Patch complexity: | Small patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: |
21.05.04, 20.11.10, 20.05.16, 19.11.22
|
|
| Circulation function: | |||
| Bug Depends on: | |||
| Bug Blocks: | 29416, 29696 | ||
| Attachments: |
Bug 28941: Filter suggestion inputs at the OPAC
Bug 28941: Filter suggestion inputs at the OPAC Bug 28941: Filter suggestion inputs at the OPAC Bug 28941: Deal with OPACSuggestionUnwantedFields Bug 28941: Deal with OPACSuggestionUnwantedFields Bug 28941: Deal with OPACSuggestionUnwantedFields |
||
|
Description
Jonathan Druart
2021-09-02 08:16:28 UTC
Since... commit 8802bbf5fe6c0b35ad4d6e00293eb102a48b92b4 Date: Tue Aug 25 23:56:16 2009 +0200 Editing C4::Suggestions.pm Created attachment 124423 [details] [review] Bug 28941: Filter suggestion inputs at the OPAC The following sequence is bad: 46 my $suggestion = $input->Vars; 181 &NewSuggestion($suggestion); All columns can be set when we insert the suggestion into the DB We definitely want to avoid the following fields to be set by the final user: acceptedby, accepteddate, STATUS, etc... You didnt need the Allow list finally Created attachment 124429 [details] [review] Bug 28941: Filter suggestion inputs at the OPAC The following sequence is bad: 46 my $suggestion = $input->Vars; 181 &NewSuggestion($suggestion); All columns can be set when we insert the suggestion into the DB We definitely want to avoid the following fields to be set by the final user: acceptedby, accepteddate, STATUS, etc... Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Created attachment 124729 [details] [review] Bug 28941: Filter suggestion inputs at the OPAC The following sequence is bad: 46 my $suggestion = $input->Vars; 181 &NewSuggestion($suggestion); All columns can be set when we insert the suggestion into the DB We definitely want to avoid the following fields to be set by the final user: acceptedby, accepteddate, STATUS, etc... Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Julian Maurice <julian.maurice@biblibre.com> IMO this is much better like this than with the allowlists implemented in the other bugs. It's a clean and simple solution. Related: OPACSuggestionUnwantedFields only hides HTML inputs. It is possible to manipulate the DOM to submit data for unwanted fields (In reply to Julian Maurice from comment #7) > Related: OPACSuggestionUnwantedFields only hides HTML inputs. It is possible > to manipulate the DOM to submit data for unwanted fields Good catch. And so this is where the AllowList module could be useful as we could have reused the "additional deny list" method :) (In reply to Jonathan Druart from comment #8) > (In reply to Julian Maurice from comment #7) > > Related: OPACSuggestionUnwantedFields only hides HTML inputs. It is possible > > to manipulate the DOM to submit data for unwanted fields > > Good catch. > > And so this is where the AllowList module could be useful as we could have > reused the "additional deny list" method :) $allowlist->remove( unwantedfields ); Created attachment 124745 [details] [review] Bug 28941: Deal with OPACSuggestionUnwantedFields Remove fields from OPACSuggestionUnwantedFields before creating the suggestion Marcel or Julian, can I get another stamp on this follow-up please? (In reply to Jonathan Druart from comment #11) > Marcel or Julian, can I get another stamp on this follow-up please? Sure Created attachment 124747 [details] [review] Bug 28941: Deal with OPACSuggestionUnwantedFields Remove fields from OPACSuggestionUnwantedFields before creating the suggestion Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Comment on attachment 124747 [details] [review] Bug 28941: Deal with OPACSuggestionUnwantedFields Review of attachment 124747 [details] [review]: ----------------------------------------------------------------- ::: opac/opac-suggestions.pl @@ +177,4 @@ > } > } > else { > + for my $f (sort split(/\s*\,\s*/, C4::Context->preference("OPACSuggestionUnwantedFields") ) ) { why `sort` ? (In reply to Julian Maurice from comment #14) > why `sort` ? Because I am lazy and copy/pasted the existing statement. Created attachment 124775 [details] [review] Bug 28941: Deal with OPACSuggestionUnwantedFields Remove fields from OPACSuggestionUnwantedFields before creating the suggestion Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> JD amended patch: remove useless sort Backported: Pushed to 20.05.x security branch for 20.05.16 == testing notes == 1. log into the OPAC and go to the suggestion form 2. add the following HTML in the form <input type="text" name="STATUS" value="ACCEPTED"> <input type="text" name="reason" value="we will buy it"> 3. submit 4. confirm the in the staff interface that it's indeed accepted 5. apply patch 6. attack doesn't work anymore Backported to 21.05.04, 20.11.10, 20.05.16, 19.11.22 Pushed to master for 21.11, thanks to everybody involved! |